Setting up and maintaining span sessions in a network typically require the administrator to overcome several obstacles when configured to monitor users, hosts and/or ports on the data network. For example, in the case where a user or a host is to be monitored, details about the connection of the user or host to the network such as how data traffic configured to be sent to the user or host is to be differentiated from other traffic on the network, for example, must be determined before a span session may be set up. Similar challenge exists if the destination of a span session is specifically defined as a user or a host. More specifically, in this case, the specific details regarding the destination host's connection (such as the IP address) must be determined.
To further add complications, after the span session is configured and set up, the connection details as discussed above may change over time depending upon the change in the network topology. Thus, a static span session may in such context not be functional especially if the source or destination may change within the network.
Moreover, in configuring and setting up span sessions across a network, traffic to be spanned across the network typically are sent out of band in some manner from the source to the destination. This may involve set up and use of a dedicated vlan (Virtual Local Area Network) or alternatively, it may involve modification of and tunneling of the monitored traffic. Substantial modification to the configuration of a network is a significant challenge especially in the case where the entity such as the administrator which initially configured the network is not involved in the process of reconfiguration of the network.
Existing approaches for setting up of span sessions in the network are generally limited in functionality as they are implemented as add-ons to the network. For example, one approach includes the examination of the configuration files on network devices, and by snooping packets. A limitation of this approach is that the configuration files on the network devices are not a substitute for the know-how of the administrator that initially configured the network. While the configuration files in the network devices provide the properties of the network configuration, they do not typically provide the reasons behind the properties for the configuration in the network. Thus, any reconfiguration of the network without fully comprehending the reasons behind the properties for the configuration of the network devices may not yield the optimum configuration.
Furthermore, with respect to the challenge of the network configuration changes over time, network add-ons may not be configured to be fully integrated into every network device in the network, and thus, cannot reliably track the users and hosts as they migrate within the network, changing the network topology. Moreover, existing approaches cannot track users or groups of users because of their dynamic nature—that is, users can migrate from machine to machine within the network, while hosts can migrate from port to port.
In view of the foregoing, it would be desirable to have methods and systems for providing network traffic flow monitoring and dynamic changes implemented automatically to the network topology to capture the modification in the network topology.